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Abstract 


Smart devices have become an important part of our 
life due to improvements in IT technology and 
corresponding increase in demand for smart devices. In 
particular, smart TVs represent a convergence of 
computers and TV and have become popular. Therefore, 
many researchers conduct smart TV forensics to 
accurately and seamlessly investigate a suspect’s actions. 
However, previous works have focused not on critical 
information, such as viewing history, but on minor 
information such as web surfing history and system 
configuration information in smart TVs. To make matters 
worse, minor information is irrelevant to time or order. 
Therefore, it is inadequate to use previous methods to 
investigate and rearrange the order of a suspect’s action. 
We therefore propose a novel method to obtain time 
relevant information in smart TVs. We find additional 
information, such as the list of TV channels that are 
watched, the last viewing time, recent service history, 
information on recently played video and recent camera 
usage information. 


Keywords: Digital forensic Investigation, Smart CE 
forensics, Smart TV 


1 Introduction 


Technological convergence between computers and 
appliances has produced smart TVs that have become 
an important part of our life. The number of smart TV 
users is increasing, and according to Parks Associate’s 
report [1], the distribution rate of smart TVs in North 
America and Eastern Europe is expected to increase 
from the current 38% and 32% in 2015 to 62% and 
54% in 2016, respectively. A smart TV not only 
provides traditional television functions, but also 
allows viewers to search content through the Web, 
install games, watch videos or photos, etc. Recently, 
smart TVs have begun to record when and what 
channels the viewer is watching. Moreover, it 
recommends an optimal TV program by analyzing user 
behavior. In order words, a smart TV may be aware of 
the user’s behavioral patterns. 

The Korea Communication Commission (KCC) is a 
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branch of Korean government, and it announced the 
results of a survey of the daily usage rate of media, 
including TV, PCs and smartphones, according to ages 
[2]. The results indicate that young people in their 20’s 
to 40’s have a much higher usage rate for smartphones 
and PCs than people over 60. However, the result 
showed that most respondents watched TV regardless 
of age. In order words, people of all ages consistently 
spend time watching TV. This fact has a significant 
meaning for digital forensics. Before smart TV 
forensics, digital forensics mainly depended on the 
analysis of a suspect’s PC or smart phone to obtain 
evidence. However, it was not sufficient for an 
investigator to trace evidence because a suspect may 
not use only a PC or smartphone all day long. 
Moreover, if the suspect is older, the probability that 
the inspector could obtain any information from a PC 
or smart phone might be low. Considering the results 
of the KCC survey [2], smart TV forensics can be very 
helpful because these strengthen the time gap defect of 
computer or smart phone forensics. In addition, since a 
smart TV is generally located in a fixed place, such as 
an office or suspect’s home, an investigator can easily 
conclude the flow of the suspect’s actions. 

Smart TVs were first released in 2010, and many 
researchers have studied smart TVs. Sutherland et al. 
[3-4] addressed the importance of smart TV forensics 
and conceptually explained that some information 
could be obtained through the system information and 
network configuration. However, he used an outdated 
version of the firmware and the amount of information 
was too small to reconstruct a suspect’s actions as legal 
evidence. Boztas et al. [5] presented additional 
information that could be obtained from smart TVs in 
DFRWS 2014. He also analyzed the user’s web access 
history and media files stored in a smart TV. However, 
his study mainly focused on functions other than 
viewing TV. He focused on minor functions in smart 
TVs such as, Internet usage or the analysis of media 
files. As mentioned above, people purchase smart TVs 
for the main purpose of watching TV. In other words, 
the analysis in [5] could be insufficient to investigate 
and rearrange the order of the suspect’s actions 
because the data are not largely associated with time or 
order. 
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Therefore, we propose a novel method to obtain 
information relevant to time or order from a smart TV. 
We find that the additional time or order based 
information, such as the TV channel list that has been 
watched, the last viewing time, the recent service 
history, recent video playback information and recent 
camera usage information. This paper consists of the 
following sections. Section 2 introduces an overview 
of digital forensics and related works. Section 3 
explains the smart TV forensics method and analyzes 
the user’s actions from time or order related 
information and static information. Section 4 shows a 
comparison with previous work with our experimental 
result. Section 5 concludes our paper. 


2 Preliminaries 


2.1 Overview of Digital Forensic 


Digital forensics is a kind of forensic science that 
encompasses the recovery and investigation of 
materials found in digital devices [6-7]. Since digital 
materials are easily manipulated or damaged, an 
investigator must prove their integrity and should 
ensure these have legal force in court. Therefore, an 


Table 1. Branches of digital forensics 


Area Content 


investigator follows procedures to collect media, 
examining data, analyzing information and report these 
as evidence. Figure 1 shows the general procedure for 


digital forensics. 


Data ———> Information —— Evidence 


Collection 


Media 


Figure 1. Digital forensic analysis process 


Traditional digital forensics has mainly focused on 
computers, such as PCs or mainframe computers. 
However, the growth in Internet usage and the 
development of network connected devices has 
expanded the domain of digital forensics. Nowadays, 
digital forensics mostly deals with not only computers 
but also smart devices, such as smart phones. Table 1 
presents the branches of digital forensics [8]. With the 
advent of the Internet of Things (IoT), smart appliances, 
such as smart TVs, have also been rapidly developed. 
On the other hand, there are few digital forensics 
methods for smart appliance because the platforms of 
the appliances vary by vendor. In this sense, our work 
can contribute to the forensics of smart appliances. 


Target Equipment 


Disk Forensics 


Analyzing files on a hard disk and recovering deleted data PC 


Memory Forensics 


Acquiring data, encoded keys, and passwords that exist in RAM 


PC, Smartphone 


Document Forensic : 
ee Excel, and PowerPoint files 


Exploring remaining data when using electronic documents such as Word, 


PC 


Email Forensics 


Analyzing sent/received emails and investigating altered emails 


PC, Smartphone 


Web Forensics 
words 


Tracing user’s Internet usage history, such as Web history, favorites, and search 


PC, Smartphone 


Network Forensics 


Acquiring network information, such as network configuration and packets 


Network equipment 


Cloud Forensics 


Exploring cloud service usage history and files used 


PC, Smartphone 


Mobile Forensics 


2.2 Related Works and Limitations 


Early studies on smart TVs mainly focused on 
hacking methods to find security vulnerabilities. 
Grattafiori and Yavor [9] and Lee and Kim [10] 
initially addressed the security vulnerabilities of smart 
TV and the probable risks in the case where a smart 
TV is attacked. On the basis of [9-10], Falayleh [11], 
Sutherland et al. [4] and Boztas et al. [5] mentioned the 
necessity to conduct smart TV forensics and the study 
of its conceptual procedure. Then, Sutherland et al. [4] 
presented an experimental study on smart TVs by 
using the LG smart TV and mentioned the kinds of 
basic information that were obtainable. However, it 
was so simple that the investigator could not recognize 
and reconstruct the suspect’s past actions only with 


Collecting and analyzing trace data existing on mobile devices 


Smartphone 


information related to system and network 
configuration. Boztas et al. [5] stated that additional 
information, such as website access logs, lists of 
installed applications, stored media files and camera 
activity history could be obtained using a disk dump. 
In general, most people spend much time watching TV 
even though smart TVs have many functions. 
Therefore, the main component of smart TV forensics 
should be to analyze the TV viewing history. However, 
[5] focused on secondary functions rather than on the 
main functions. In addition, the results of [5] are not 
associated with time, so it is not enough in order for 
the investigator to rearrange the suspect’s actions as 
digital evidence. Thus, it is necessary to investigate 
and obtain data that focuses on TV viewing. 


3 Our Experimental Forensics on Smart 
TV 


3.1 Material Environment 


In this section, we describe the material environment 
for our experiment. We used a Samsung smart TV with 
model number un46es8000. The reason we chose a 


Camera & motion Recognition sensor 
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Samsung smart TV was that it was the most popular 
smart TV in 2014 [12]. The internal composition of 
un46es8000 is very similar to that of any computer. In 
addition to a TV tuner, it has an ARM based CPU, 
DDR3 main memory, a WiFi module and an Ethernet 
port for network communication. The firmware version 
is TECPAKUC 1041.1, BT-S/G, which is modified 
from Linux. 


Tuner Bluetooth Module 


Figure 2. Samsung Smart TV (un46es8000) 


3.2 Methods 


In this section, we address the methods for smart TV 

forensics. In order to trace a suspect’s actions, we 
should first understand the internal structure of the 
target smart TV and its file system. As with the digital 
forensics procedure in Section 2, we used the following 
method for Smart TV forensics: (1) acquiring root 
privilege (2) understanding the internal structure (3) 
collecting and examining data (4) analyzing 
information and producing a report. 
Acquiring root privileges. An investigator has to 
acquire system root privileges to image the data in 
order to analyze the system and file structure of a smart 
TV. In general, a disk dump method is available for the 
root authorization conditions. We have used the system 
vulnerability of the Linux system mentioned in Ref. 
[10] to obtain root privileges. Then, we imaged the 
entire data on the target by using the ‘dd’ program in 
the firmware. In order to acquire root privileges on the 
smart TV, an application is required to installed, which 
exploits vulnerabilities. It, however, does not overwrite 
any data on the smart TV due to the fact that the 
application is installed in a portion of the unallocated 
memory. The collection and survey of the data, 
accordingly, do not affected. Although this method 
does not guarantee the integrity of a disk, it is currently 
the best method. Boztas used Samygo root tools and 
the same problem occurs [6]. In the case of smart 
phones, digital forensic analysis also goes through a 
rooting process. Depending on the types of smartphone, 
the same problems occur [14]. Therefore, it is 
necessary to study the rooting method, which does not 
write data in a data area, to solve the integrity issue. 


Understanding internal structure: An investigator 
should understand the internal structure to analyze the 
files that are needed. However, a file system in smart 
TV varies according to vendors. Samsung usually uses 
a RFS (Robust File System). But through empirical 
analysis, VFAT (Virtual File Allocation Table) file 
system was identified. Figure 3 shows its mount 
information for current flash memory and VFAT file 
system. 


Figure 3. Mount information 


Thus, we have referred to the VFAT file system that 
is openly provided on the Internet to understand the 
structure. Referring to [13], we can more easily be 
aware of the system and file structure in a smart TV. 
Table 2 shows the major parts of the partitions for 
un46es8000. 


Table 2. Major parts of the functions on un46es8000. 


Device Boot Path File System 
/dev/mmceblk0p10 /mtd_drmregion_a RFS (VFAT) 
/dev/mmceblk0p11 /mtd_drmregion_b RFS (VFAT) 
/dev/mmcblk0p12 /mtd_rwarea RES (VFAT) 
/dev/mmcblk0p14 /mtd_exe - 
/dev/mmcblk0p15 /mtd_rcommon - 
/dev/mmcblk0p16 /mtd_emanual RES (VFAT) 
/dev/mmcblk0p17 /mtd_contents RES (VFAT) 
/dev/mmcblk0p18 /mtd_swu RES (VFAT) 
/dev/mmcblk0p19 /mtd_rwcommon RFS (VFAT) 
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Data collection and examination. The purpose to 
collect and examine data is to understand the 
connectivity and dependency between the files and 
functions in a smart TV. For example, if we first turn 
on a smart TV, some data files can be used and may 
affect other related files. First, to collect and examine 
data, we have enumerated the smart TV functions, such 
as turning on the TV, selecting the channels, installing 
and playing applications, storing media files and so on. 
Next, to determine which files are involved in those 
functions, it is necessary to check the binary changes in 
the files before and after operating the functions. Thus, 
we followed these steps: (1) pre imaging (2) testing (3) 
post imaging and (4) binary diffing. First, in the pre 
imaging step, we imaged the entire disk volume before 
operating the functions. Next, during the testing step, 


00 00 00 00 oo 00 00 00 00 00 00 00 
BC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

I 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
FDC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
FEC 00 00 00 00 00 00 00 00 00 00 00 AL oo oo 0.00 
FC 00 00 00 00 31 32 2C 32 36 2C 20137 2c 33 34foo 

00 00 00 00 00 00 00 00 00 00 00 DUN UN UT 00 

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

An nn an an An an An An 


00 00 00 00 


nn nn nn nn an nn nn an 


Offset Oi 2.3. 4. Ss 


INcaRAAr AN AN AN AN AN AN AM AN AN AM AN AN AN AN AM AN 


we executed the list of functions on the smart TV. 
Then, during post imaging, as with pre imaging, we 
reimaged the entire disk volume after operating the 
functions. Finally, during the binary diffing step, we 
compared the changes in the binary between the pre 
image and post image disk volume. We finally, 
determined the parts of the disk that are linked to the 
smart TV functions. For example, the disk partition 
mmcblk0p12 was imaged at 16:34 26th Dec. Then, we 
turned on the TV. Next we reimaged the disk at 18:28 
26th Dec. Finally, we found that the 4 byte change in 
00C8E007 offset in the mmcblk0p12 partition and 
recognized the likability between the part around 
00C8E007 offset and the PowerOnTime.dat file. 
Figure 4 presents the binary diffing example. 


C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
£ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
C 00 00 00 00 00 00 OO 00 00 00 00 00 00 00 0000 
0 00 00 00 31 32 2C 32 36 2C 20] 
C 00 00 00 00 00 00 00 00 00 00 0000000000 00 
C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 


Undo level: a 6 7 So: 2 D CD E F | a) = | a 
Unde feverees a |[oocsE000 31 32 2C 32 36 2C 20 39 2C 32 38]oo 00 00 00 00 12,26, 9,28..... 
PORTS DOC8E010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 OO ................ 
O Tag] 20C8E020 00 00 00 00 00 00 00 00 00 00 00 00 00 000000 ................ 
eros e owerontime | 00C8E030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 OO ................ 
if} oocezos40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........o.o..... 
Snapshot taken 15 min. ago 00C8E050 00 00 00 00 00 00 00 00 OO 00 00 00 00 00 00 OO ................ 

nacerncn an an na na an na na nn an na na na na an nn nn 
Figure 4. Binary diffing 
Information analysis and report. For the information 0x36(6),  0x2C(identifier), 0x20(space), 0x39(9), 


analysis and report, the investigator analyzes the data 
to provide meaning and to link it to the suspect’s 
actions. The investigator then produces evidence from 
the result of the analysis and generates a report. In this 
paper, we will not deal with the reporting step because 
this is the responsibility of an investigator. Instead, we 
will focus on describing our results in detail in Chapter 
3.3. 


3.3 Information Analysis for a Smart TV 


In this chapter, we explain the results of our 
experimental analysis on a smart TV. We could 
determine the user’s actions as follows: (1) Last time 
the TV was turned on; (2) History of web access; (3) 
Recently operated service list; (4) Thumbnails of video 
files that were recently played; (5) Application 
information; (6) Camera Usage Information; (7) 
Selected TV channel list; (8) Selected TV channel list. 
Last time the TV was turned on. We determined the 
last time the user turned on the TV from the 
/mtd_rwarea/PowerOnTime file. The PowerOn-Time 
file is 11 bytes in size and consists of four numbers and 
three identifiers. Given that the TV is turned on at 
09:28 GMT on December 26, 2013, the PowerOn- 
Time would record the month, day, hour and minute 
information into ASCII characters and hex values 
according to the identifier. Therefore, we could see the 
hex values as 0x31(1), 0x32(2), 0x2C(identifier), 0x32(2), 


0x2C(id-entifier), 0x32(2) and 0x38(8). PowerOnTime 
can only write the information when the TV is turned 
on. Thus, we can only know the last date and time 
when the TV was turned on. This time information is 
automatically synchronized with a predetermined time 
through samsung smart TV server or manually set up 
by a user. Default time setting is automatically set 
through samsung server. Figure 5 shows the system 
menu. If a user modifies the time information for a 
malicious purpose, it will not be possible to trust the 
time information of the system. Such a time 
information manipulation is a typical anti-forensic 
technique and it decreases the reliability of the 
collected log data. This occurs to a majority of digital 
devices such as the PC and the smart phone in addition 
to the smart TV. Generally, in order to resolve this 
issue, the information of all log files are confirmed and 
the time consistency is assured [15-16]. If one wants to 
alter time with malicious intention without being 
caught, the person shall modify time with considering 
time information in all log files. This is the latter 
requires much effort because the person must consider 
the time consistency of a large number of log files that 
contain time information. However, the smart TV does 
have less log file types compared to the PC and the 
smart phone. Therefore, it does not have enough 
information to confirm the time consistency. Therefore, 
it requires much more time-related information to 


analyze the time manipulation of the smart TV. 
Furthermore, additional studies are required regarding 
the time information manipulation. In addition to the 
date and time information, we could see yearly 
information using /mtd rwcommon/LogPolicycon-fig.xml, 
LogPolicyconfig.xml stores the logging policy for 
applications. Its tag “period val” has the expiration 
information in terms of the date and time, including 
year, as shown in Figure 6. When the TV is turned on, 
the logging policy updates in 2 or 3 days. Thus, we 
could know the yearly information linking LogPolicy- 
config.xml with PowerOnTime. 


Clock 
Choose your preferred 


| | clock. 
| 


Clock Mode 


| Manual 


Figure 5. System menu (Clock) 


<?xml version="1.0" encoding="UTF-8" ?> 


ered val"2014-04-19107:24:05" | 
~ <list> 
- <service name="kids” url="https:/ /Icprd1.samsungdoudsolution.net/openapi/log/kids” 
queue_max="30" expiration="60" loglevel="10"> 
<event name="WATCHTUTORIALVIDEO" loglevel="5" /> 
<event name="PLAY” loglevel="5" /> 
<event name="SAMSUNGLOGIN" loglevel="5" /> 
<event name="SAMSUNGLOGOUT" loglevel="5" /> 
<event name="CHANGECHARACTER" loglevel="5" /> 
<event name="TOOLS” loglevel="5" /> 
<event name="RETURN" loalevel="5" /> 


sung.com/api/1.0"> 


Figure 6. LogPolicyConfig.xml 


Recently operated service list. We found that the 
most important file storing information for TV viewing 
was in the /mtd_rwarea/ Re-centlyServiceManager.dat 
file. The file has three recent records regardless of 
services. The types of service stored include TV 
channels that have been watched, information on 
applications that are used, URL that has been visited, 


<Medialnformation> 
<VideoLocator> 
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and the name of video files that are played. Recent- 
lyServiceManager.dat does not record the time infor- 
mation of the services, but the information is recorded 
in the time order. Therefore, we could arrange a user’s 
actions related to the services in the time order. In 
particular, when the file has a URL that has been 
visited, we could easily infer the user’s actions because 
the user’s web page visit history includes time 
information. Table 3 shows the information that can be 
obtained through a combination of the 
RecentlyServiceManager.dat with other files. 


ID URL TITLE LASTVISITDATE FREQUENCY 
1 | ‘http //bing,search,daum.ney ___. | http://bing, searc 1381560274 3 
2 2 http://search, daum, net/bing?q=bing |http://search, dat 1381560285 1 


Figure 7. Web access history 


Table 3. Combination and analysis with other files 


File Name 
RecentlyServiceManager.dat 


Contents 
The last three TV channels 
the user watched 
Thumbnail images of the 
last three videos the user 
watched 
Names of the last three 


RecentlyServiceManager.dat 
+ RecentlyPlayed.dat 


RecentlyServiceManager.dat 


+ Info.xml applications the user ran 
RecentlyServiceManager.dat List of the last three 
+ 0000000000000002.db Websites the user visited 


Thumbnails of recently played video files. When we 
watch a video file from external storage, the thumbnail 
images from the video are created and stored into mta 
files with the XML format. The directory location is 
/mtd_common/RecentlyPlayed, and the directory limits 
the number of files as 8 mta files, and each mta file has 
5 thumbnails of recently played video files. Figure 8 
shows an example of the thumbnail images in the mta 
file. 


<MediaUri>file://samsung_content.con</MediaUri> 


</VideoLocator> 
</MediaInformation> 
<ContentInformation> 
<Chaptering> 
<ChapterSegment> 
<KeyF rame> 


/MediaPosition> 
</Chag -Segment> 

e egment> 
KeyFrame> 


Base64 
Binary Decode 


<MediaTime timePoint="2636"/> 


<InlineMedia>/ 973 


Figure 8. An example of thumbnail images in an mta file 
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Camera usage information. We could determine the 
trace of the camera usage in a smart TV in the 
/mtd_rwcommon/common/111199000-764/CameraApp 
FileInfo.xml file. The file records information 
whenever the camera is used and stores information for 
a picture that was taken including the date and time, 
name, stored file location, stored thumbnail image 
location, resolution, size and playing time. When the 
camera is powered, the usage time information is 


<?xml version="1.0° encoding="UTF-8°?> 
<list> 


written in PowerOnTime and in 0000000002.db 
simultaneously. 

Additional information. Our study results also 
showed the web access history, application information, 
saved TV channel list and external usage storage 
information described in Boztas [5]. The information 
was confirmed to be the same as the study results of 
Boztas [5]. Figure 9 shows this information. 


<widget id="111199000939" name= Fitness VOD” lock= false” removable= true” installedDate="20130515112330530" ispBound="false”> 
<icon type= normal >LIST_ON_20111222045223566.png</icon> 
<icon type= focus >THUM_LIST_OFF_20111222045223566.png</icon> 
<icon type="icon1080"X/icon> 

</widget> 


<icon type= normal >icon/95.png</icon> 
<icon type=" focus >icon/106.png</icon> 
<icon type="icon1080"></icon> 


<widget id="111199000764° name= Camera” lock="false” removable="false” installedDate="20120726110046164" runTitle= CameraApp” ispBound= false"> 


Figure 9. Application information 


4 Comparison 


Table 4 presents a comparison of the previous works 
with the results of our experiment on smart TV 
forensics. We obtained additional information related 
to time or order that the previous works were not able 
to obtain. Therefore, we could conduct a chronological 
analysis of the user’s actions on the smart TV. In 
addition, our experiment focus on major TV functions, 
such as the last time the TV was turned on and the list 
of channels that were recently watched. Thus, it would 
be helpful for an investigator to provide more accurate 
and diverse behavior of the suspect than previous 
studies. 


Table 4. Comparison the previous works with our 
result of experiment 


User’s action Ours 
Last time TV turned on 
History of the web access 
Recent operated function list 
Recent watched channels 
Recent used applications 
Recent accessed URL 
Recent played video files 
Thumbnails of recent played 
video files 
Saved TV Channel List. 
Application information 
Non time Camera Usage Information 
or order External Storage Usage 
relevant Information 
System and Network 


Configuration 


Info Type 


— 
> 
— 
— 
n 
Mad 


Time 


Order 


IRA LPT PST P<] << ng |< 
O | O X<O/0|' x |OIOJO|x1x<°[O|x 
O | O joo O JOJO/OJOJOsO};O 


5 Conclusion 


We have examined a novel method to conduct 
forensics on a smart TV. We deter-mined the time or 
order related information in a smart TV, including the 
last time the TV was turned on, the list of recently 
operated functions, the list of recently watched 
channels, recent video file playback and camera usage 
information. The previous works in [4] and [5] have a 
weaknesses in that they do not focus on major 
functions and analyze non-time relevant information. 
Therefore, such information is insufficient to allow the 
investigator to rearrange a suspect’s actions due to the 
lack obtainable information and non-time relevant 
information. Therefore, the result of our experiment 
overcomes the weaknesses of previous works and 
enables an investigator to more easily produce 
evidence. For future research, we will expand this 
subject to various smart appliances, such as robot 
vacuums and refrigerators. Also, we will study live 
forensic methods for smart devices by using a memory 
dump. Additional analysis on various models will be 
needed because the results may differ depending on the 
types of smart TV. 
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